Our principle is simple: store only what a coach needs, and protect it properly. This page explains, in plain language, how your data is handled. The formal version is the Privacy Policy.

1. Minimal by design

We built the Service to need as little of your data as possible:

No GPS. Ever. Location fields (coordinates, routes — about 25 different fields) are stripped from workout data before anything is written to our database. We do not know where you train.
Year of birth only — never your full birth date.
No name, email, phone, or address required. Your account is just your Telegram ID.
No raw IP addresses and no full browser user-agent strings stored by our site analytics.
No card details — payments happen inside Telegram; we only see that a payment occurred.
Voice stays local. Voice messages are transcribed on our own infrastructure; the audio file is deleted immediately, and only the text remains.

2. Where your data lives

All account and health data is stored in a database in the European Union, with encryption at rest. Everything travels over TLS encryption in transit. Our wearable-data aggregator is connected through its EU endpoint, so device data also stays on EU infrastructure.

3. Who can see what

Other users: nothing. Every single database table is protected by row-level security — isolation is enforced by the database itself, not just by application code. Even a bug in our code cannot expose one user’s data to another.
Administrators: aggregates only. The admin panel shows counters and statistics, never your raw health records. Admin access requires two-factor authentication.
Menstrual cycle data: you alone. This is the strictest tier. If you opt in, we store only period start dates, and database-level policies make them technically inaccessible to administrators. You can delete this data at any moment, separately from everything else.

4. How AI touches your data

Your sport metrics are computed by deterministic code — not by AI. The AI model only turns finished numbers into coaching language. It receives exactly two things:

a prepared briefing: aggregated numbers and facts produced by our code — never direct access to the database;
the messages you write to the coach yourself.

Our AI provider is contractually barred from training its models on this content. Transfers to the provider (based in the USA) are covered by a data processing agreement with EU Standard Contractual Clauses; our site host and analytics provider are certified under the EU-U.S. Data Privacy Framework.

Health data is processed only after your explicit consent in the Bot. Cycle tracking requires a second, separate consent. Every consent is recorded with its scope, timestamp, and the policy version in force — and you can withdraw any of them at any time.

6. Your controls

Directly in the Bot, you can:

Export everything we hold about you as JSON;
Delete your account — a cascade wipes all your data across all our tables and disconnects your device at the aggregator, including deletion of your data there;
Delete cycle data separately, or withdraw any consent, at any time.

Requests are honored within 30 days at most; deletion in the Bot is executed immediately.

7. Website analytics, without surveillance

Our own site beacon is cookie-free: page path, language, device category, country code, referrer host — and nothing that identifies you personally. No raw IP is stored. Google Analytics runs only if you accept the cookie banner; until then it sets no cookies and sends no identifying data (Google Consent Mode v2, denied by default).

8. Operational security

All incoming webhooks (device data, payments) are signature-verified.
Secrets and keys live outside the codebase.
Administrator actions are recorded in an audit log.

9. If something goes wrong

If we ever discover a security incident affecting your personal data, we will assess it immediately, notify the competent supervisory authority where legally required, and inform you without undue delay if the incident is likely to put your rights at risk — with a clear explanation of what happened and what we are doing about it.

10. Questions

Security or privacy questions: privacy@sportai.link · General: hello@sportai.link

This page is drawn up in English; translations are provided for convenience, and the English version prevails in case of discrepancy.